pub-3019d8288f8446f9972a55bb08a4c968[.]r2[.]dev

Analysis of the domain pub-3019d8288f8446f9972a55bb08a4c968.r2.dev shows that it was registered through Cloudflare on 21 February 2026. The site resolves to the IPv6 address 2606:4700:3117::6812:3222, which belongs to AS13335 operated by Cloudflare, Inc., and the hosting location is the United States. The TLS certificate presented is issued by Let’s Encrypt (E7), indicating a valid, automatically‑renewed certificate. The only page title observed is “Suspected phishing site | Cloudflare”, and the HTTP response code is 404, suggesting that the malicious landing page is no longer hosted.

VirusTotal records indicate that 12 of 93 scanned security vendors flagged the domain, providing independent confirmation of malicious intent. The domain appears on at least one public blocklist and is specifically listed by PhishDestroy as a blocked phishing site. Current monitoring shows the domain is taken offline, but the historical evidence points to a short‑lived phishing operation that leveraged Cloudflare’s free hosting and a legitimate SSL certificate to increase perceived trust.

Uncertainty remains regarding the exact target brand, the phishing kit used, and whether any credential harvesting succeeded before takedown. Defenders should continue to block the IPv6 address and the domain at perimeter firewalls, update URL filtering lists with the observed indicator, and monitor for any newly registered subdomains under the same Cloudflare account. Because the domain was created only months ago, rapid registration of similar identifiers should be considered a risk indicator for future campaigns.